|
1 | 1 | require 'metasploit/framework/tcp/client' |
2 | | -require 'metasploit/framework/mssql/tdssslproxy' |
3 | 2 | require 'rex/proto/mssql/client_mixin' |
4 | 3 | require 'rex/text' |
5 | 4 | require 'msf/core/exploit' |
@@ -372,12 +371,7 @@ def mssql_login(user='sa', pass='', db='', domain_name='') |
372 | 371 | # has a strange behavior that differs from the specifications |
373 | 372 | # upon receiving the ntlm_negociate request it send an ntlm_challenge but the status flag of the tds packet header |
374 | 373 | # is set to STATUS_NORMAL and not STATUS_END_OF_MESSAGE, then internally it waits for the ntlm_authentification |
375 | | - if tdsencryption == true |
376 | | - #proxy = TDSSSLProxy.new(sock, sslkeylogfile: sslkeylogfile) |
377 | | - #proxy.setup_ssl |
378 | | - #resp = proxy.send_recv(pkt) |
379 | | - @mstds_channel.starttls |
380 | | - end |
| 374 | + @mstds_channel.starttls if tdsencryption |
381 | 375 | resp = mssql_send_recv(pkt, 15, false) |
382 | 376 |
|
383 | 377 | # Strip the TDS header |
@@ -484,15 +478,8 @@ def mssql_login(user='sa', pass='', db='', domain_name='') |
484 | 478 | # Packet header and total length including header |
485 | 479 | pkt = "\x10\x01" + [pkt.length + 8].pack('n') + [0].pack('n') + [1].pack('C') + "\x00" + pkt |
486 | 480 |
|
487 | | - if self.tdsencryption == true |
488 | | - proxy = TDSSSLProxy.new(sock, sslkeylogfile: sslkeylogfile) |
489 | | - proxy.setup_ssl |
490 | | - resp = mssql_ssl_send_recv(pkt, proxy) |
491 | | - proxy.cleanup |
492 | | - proxy = nil |
493 | | - else |
494 | | - resp = mssql_send_recv(pkt) |
495 | | - end |
| 481 | + @mstds_channel.starttls if tdsencryption |
| 482 | + resp = mssql_send_recv(pkt) |
496 | 483 |
|
497 | 484 | end |
498 | 485 |
|
@@ -564,10 +551,6 @@ def mssql_prelogin(enc_error=false) |
564 | 551 | data |
565 | 552 | end |
566 | 553 |
|
567 | | - def mssql_ssl_send_recv(req, tdsproxy, timeout=15, check_status=true) |
568 | | - tdsproxy.send_recv(req) |
569 | | - end |
570 | | - |
571 | 554 | def query(sqla, doprint=false, opts={}) |
572 | 555 | info = { :sql => sqla } |
573 | 556 | opts[:timeout] ||= 15 |
|
0 commit comments